GRVA-25-35
Cyber Security task force (aka CS/OTA) status report to GRVA

The Informal Working Group on Cyber Security and Software Updates discussed amendments to UN R155 and UN R156 for multi-stage approval, including simplified handling for low-risk devices and clarification of intrinsic cyber risk assessment. The group reviewed proposals from GRVA-25-31 and GRVA-25-32 concerning continued validity of approvals and Certificate of Compliance issuance. A Sub-Working Group was established to develop component and separate technical unit approval concepts. Pending discussion include RXSWIN application to components, STUs, and the extent of application to UN R155 and UN R156, and type-approval numbering for software updates.

UNECE server
Excerpts from session reports
GRVA | Session 25 | 18-22 May

32. During the consultations, the experts reviewed informal document GRVA-25-07, which proposed that the Certificates of Compliance issued under UN Regulations Nos. 155 and 156, as well as any subsequent type approvals, be granted by the same Type Approval Authority. Experts from CLEPA, EME and OICA presented an alternative proposal (GRVA-25-41). The expert from the United Kingdom of Great Britain and Northern Ireland, Co-Chair of the IWG on Cyber Security and Software Updates, then presented the group’s status report (GRVA-25-35), including ongoing considerations regarding the multi-stage approval of vehicles under UN Regulation No. 155, amendments to the interpretation document (GRVA-25-32), the use of separate technical services and component approval under UN Regulation No. 155, and the integration of software identification provisions into the relevant UN Regulations under the purview of GRVA (GRVA-25-30). He recalled that the group’s mandate would expire in November 2026 and proposed revising its Terms of Reference in September 2026. He also presented GRVA-25-31, containing a proposal originally developed during the workshop on the implementation of UN Regulations Nos. 155 and 156, aimed at clarifying the scope of UN Regulation No. 155 by excluding certain equipment installed in vehicles where such equipment does not pose a cyber security risk.

33. GRVA endorsed the status report of the IWG on CS/OTA (GRVA-25-35).

34. GRVA requested the secretariat to distribute GRVA-25-07, GRVA-25-30, GRVA-25-31 and GRVA-25-32 with official symbols at the September 2026 GRVA session.